IJHack / QtPass

QtPass is a multi-platform GUI for pass, the standard unix password manager.
https://qtpass.org/
GNU General Public License v3.0
1.03k stars 162 forks source link

LAN sync request #427

Closed ghost closed 6 years ago

ghost commented 6 years ago

It would be very nice to see local LAN synchronization, like 1password4 has. I think it's the safest sync method after cable. Or p2p sync also came to my mind - no password managed has that yet. Would it be possible?

jounathaen commented 6 years ago

tldr: This is not the responsibility of qtpass

Shurely it would be possible, but the approach of pass and qtpass is to provide an interface to pgp encrypted password files. The synchronization of the files is in the responsibility of the user. You can sync the password repository via any 3d party software you like (dropbox, resillio sync, ssh copy), but this is not the task of pass/qtpass.

So to get LAN synchronization or P2P syncronization, you "simply" have to setup a software that does that for files and folder and synchronize the content of your .password-store directory.

The traditional approach for pass/qtpass is, to create a git repository on a server you trust (nothing public like for example github) and use git as the synchronization back-end. If you set up the git server in your LAN, it would only be accessible from there.

One word about security: The only way to achieve security is to encrypt the data correct. Then it is not possible to ~encrypt~ decrypt it, no matter how many people can see the encrypted data. Achieving Security by hiding the data ~does~ does not guarantee security. PGP is afik at the moment a pretty secure encryption method (depending on the key length and passphrase security), but the name of the password file is not encrypted. Therefore, do not make it public if you don't like other people to know what passwords you have. But if you transfer files via an transport encrypted channel, such as ssh or https, no one on the way can read the filenames.

jounathaen commented 6 years ago

Is there anything to add to this issue? Otherwise I'd suggest to close it...

ghost commented 6 years ago

No it isn't jounathaen. Thank you for your answer. Happy Christmas 🎄

jounathaen commented 6 years ago

Can you or @annejan close it? I don't have the permissions for it...